Skip to content

Fix And Enhance Stancer #98

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
eldy merged 2 commits into from
Mar 24, 2026
Merged

Fix And Enhance Stancer #98

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8053d3d
fix and enhance stancer
Daoud-mohamed Mar 17, 2026
88e625c
enhance and add some controls
Daoud-mohamed Mar 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
77 changes: 69 additions & 8 deletions htdocs/stancerdolicloud/class/actions_stancerdolicloud.class.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -366,7 +366,7 @@ public function doPayment($parameters, &$object, &$action, $hookmanager)
$lastproxy = end($tmphosts);

include_once DOL_DOCUMENT_ROOT.'/website/class/website.class.php';
$tmpwebsite = new Website($db);
$tmpwebsite = new Website($this->db);
$tmpwebsite->fetch(0, $ws);

if (preg_replace('/https?:\/\//i', '', $tmpwebsite->virtualhost) == $lastproxy) {
Expand Down Expand Up @@ -412,7 +412,9 @@ public function doPayment($parameters, &$object, &$action, $hookmanager)
$urlback .= 'action=returnDoPaymentStancer';

if ($action == "returnDoPaymentStancer") {
dol_syslog("Data after redirect from stancer payment page with session FinalPaymentAmt = ".$_SESSION["FinalPaymentAmt"]." currencycodeType = ".$_SESSION["currencyCodeType"], LOG_DEBUG);
dol_syslog("Data after redirect from stancer payment page with session FinalPaymentAmt = ".$_SESSION["FinalPaymentAmt"]." currencycodeType = ".$_SESSION["currencyCodeType"], LOG_DEBUG, 0, '_payment');

$_SESSION['paymentoksessioncode'] = getRandomPassword(true, null, 20); // key between newpayment.php to paymentok.php to avoid direct access to paymentok.php without going through newpayment.php

$stancerurlapi = "api.stancer.com";
if (getDolGlobalInt("STANCER_DOLICLOUD_LIVE")) {
Expand All @@ -436,7 +438,7 @@ public function doPayment($parameters, &$object, &$action, $hookmanager)
if ($ret1["http_code"] == 200) {
$result1 = $ret1["content"];
$json1 = json_decode($result1);
$urlredirect .= "paymentok.php?fulltag=".urlencode($FULLTAG);
$urlredirect .= "paymentok.php?fulltag=".urlencode($FULLTAG)."&paymentoksessioncode=".urlencode($_SESSION['paymentoksessioncode']);
header("Location: ".$urlredirect);
exit;
} else {
Expand Down Expand Up @@ -522,15 +524,20 @@ public function doPayment($parameters, &$object, &$action, $hookmanager)
$headers[] = "Authorization: Basic ".$encodedkey;
$headers[] = "Content-Type: application/json";

$methods_allowed = ["card"];
if (getDolGlobalInt("STANCER_DOLICLOUD_ALLOW_SEPA")) { // If SEPA is allowed in configuration, we add it.
$methods_allowed[] = "sepa";
}
$jsontosenddata = '{
"amount": '.$amount.',
"currency": "'.strtolower($currencyCodeType).'",
"methods_allowed": '.json_encode($methods_allowed).',
"return_url": "'.$urlback.'"';
$jsontosenddata .= '}';

$urlforcheckout = "https://".urlencode($stancerurlapi)."/v2/payment_intents/";

dol_syslog("Send Post to url=".$urlforcheckout." with session FinalPaymentAmt = ".$FinalPaymentAmt." currencyCodeType = ".$currencyCodeType, LOG_DEBUG);
dol_syslog("Send Post to url=".$urlforcheckout." with session FinalPaymentAmt = ".$FinalPaymentAmt." currencyCodeType = ".$currencyCodeType, LOG_DEBUG, 0, '_payment');

$ret1 = getURLContent($urlforcheckout, 'POSTALREADYFORMATED', $jsontosenddata, 1, $headers);
if ($ret1["http_code"] == 200) {
Expand All @@ -540,7 +547,7 @@ public function doPayment($parameters, &$object, &$action, $hookmanager)
$urlforredirect = "https://".urlencode($stancerurlpayment)."/".(!getDolGlobalInt("STANCER_DOLICLOUD_LIVE") ? "test_" : "").$_SESSION["STANCER_DOLICLOUD_PAYMENT_ID"];

// Gestion redirection
dol_syslog("Send redirect to ".$urlforredirect);
dol_syslog("Send redirect to ".$urlforredirect, LOG_DEBUG, 0, '_payment');

header("Location: ".$urlforredirect);
exit;
Expand Down Expand Up @@ -604,6 +611,24 @@ public function isPaymentOK($parameters, &$object, &$action, $hookmanager)
$ispaymentok = false;

if (in_array($parameters['paymentmethod'], array('stancerdolicloud'))){

// Prevents direct access to the paymentok page without a valid session flow.
if (GETPOST('paymentoksessioncode') !== $_SESSION['paymentoksessioncode']) {
$error++;
$errmsg = 'Attempted direct access to the paymentok page without a valid session.';
dol_syslog($errmsg, LOG_ERR, 0, '_payment');
$this->errors[] = $errmsg;
}

// Ensures the session holds a valid Stancer payment ID before any API call is attempted.
$FinalPaymentID = empty($_SESSION["STANCER_DOLICLOUD_PAYMENT_ID"]) ? '' : $_SESSION["STANCER_DOLICLOUD_PAYMENT_ID"];
if (!$error && empty($FinalPaymentID)) {
$error++;
$errmsg = 'Stancer payment verification failed: STANCER_DOLICLOUD_PAYMENT_ID is not set in session.';
dol_syslog($errmsg, LOG_ERR, 0, '_payment');
$this->errors[] = $errmsg;
}

$code = GETPOST("code");

if ($code == "refused") {
Expand All @@ -625,13 +650,45 @@ public function isPaymentOK($parameters, &$object, &$action, $hookmanager)

$FinalPaymentID = $_SESSION["STANCER_DOLICLOUD_PAYMENT_ID"];
$urlforcheckout = "https://".urlencode($stancerurlapi)."/v2/payment_intents/".$FinalPaymentID;
dol_syslog("Send Get to url=".$urlforcheckout." with session STANCER_DOLICLOUD_PAYMENT_ID = ".$FinalPaymentID, LOG_DEBUG);
dol_syslog("Send Get to url=".$urlforcheckout." with session STANCER_DOLICLOUD_PAYMENT_ID = ".$FinalPaymentID, LOG_DEBUG, 0, '_payment');
$ret1 = getURLContent($urlforcheckout, 'GET', "", 1, $headers);
if ($ret1["http_code"] == 200) {
$result1 = $ret1["content"];
$json = json_decode($result1);
if (in_array($json->status, array("captured", "authorized", "capture_sent", "to_capture"))) {
$ispaymentok = true;

// Ensures the payment confirmed by Stancer matches exactly what was presented to the user
$FinalPaymentAmt = empty($_SESSION["FinalPaymentAmt"]) ? '' : $_SESSION["FinalPaymentAmt"];
$currencyCodeType = empty($_SESSION['currencyCodeType']) ? '' : $_SESSION['currencyCodeType'];

if (!empty($FinalPaymentAmt) && !empty($currencyCodeType)) {
$expectedAmount = (int) round($FinalPaymentAmt * 100);
$expectedCurrency = strtolower($currencyCodeType);
$returnedAmount = isset($json->amount) ? (int) $json->amount : null;
$returnedCurrency = isset($json->currency) ? strtolower($json->currency) : null;

if ($returnedAmount !== $expectedAmount || $returnedCurrency !== $expectedCurrency) {
$error++;
$errmsg = 'Stancer payment information mismatch: expected amount '
.$expectedAmount
.' and currency '.$expectedCurrency
.', got amount '.$returnedAmount
.' and currency '.$returnedCurrency;
dol_syslog($errmsg, LOG_ERR, 0, '_payment');
$this->errors[] = $errmsg;
}
}

if (!$error) {
if (in_array($json->status, array("captured", "authorized", "capture_sent", "to_capture"))) {
dol_syslog("Stancer payment status OK: ".$json->status, LOG_DEBUG, 0, '_payment');
$ispaymentok = true;
} else {
$error++;
$errmsg = 'Stancer payment not in an accepted status. Status: '.$json->status;
dol_syslog($errmsg, LOG_ERR, 0, '_payment');
$this->errors[] = $errmsg;
$ispaymentok = false;
}
}
} else {
$arrayofmessage = array();
Expand All @@ -653,6 +710,10 @@ public function isPaymentOK($parameters, &$object, &$action, $hookmanager)
$this->errors[] = $langs->trans("UnkownError").' - HTTP code = '.$ret1["http_code"];
}
}

$errmsg = 'Stancer API HTTP error: code='.$ret1["http_code"].' for payment ID '.$FinalPaymentID;
dol_syslog($errmsg, LOG_ERR, 0, '_payment');

$error++;
$ispaymentok = false;
}
Expand Down
Loading